Archive
April 2017
Vulnerabilities first published in this month (UTC), newest first.
1,569 results · Feed
-
Unscored —
A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole "Simple P…
-
Unscored —
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performe…
-
Unscored —
Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases. …
-
Unscored —
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier ha…
-
Critical 9.8
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier ha…
KEV Feb 24, 2025 -
Unscored —
libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds r…
-
Unscored —
Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch…
-
Unscored —
Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via th…
-
Unscored —
Stack-based buffer overflow in the ipv6_addr_from_str function in sys/net/network_layer/ipv6/addr/ipv6_addr_from_str.c …
-
High 7.8
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion…
KEV May 24, 2022 -
Unscored —
A Heap-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. This vulne…
-
Unscored —
A Stack-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. This vuln…
-
Unscored —
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled…
-
Unscored —
FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builde…
-
High 7.3
Improper Input Validation in Apache Hadoop
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.
-
Medium 6.1
Improper Neutralization of Input During Web Page Generation in Apache Hadoop
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.
-
Unscored —
IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the fa…
-
Unscored —
IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for…
-
Unscored —
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's…
-
Unscored —
Buffer overflow in PrivateTunnel 2.7 and 2.8 allows local attackers to cause a denial of service (SEH overwrite) or pos…
-
Unscored —
A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endp…
-
Unscored —
A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The appl…
-
Unscored —
The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is…
-
Unscored —CVE-2017-7293 Public exploit
The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user t…
-
Unscored —
dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechan…
-
Unscored —
TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rul…
-
Unscored —CVE-2017-8220 EPSS 37%
TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with…
-
Unscored —CVE-2017-8222 Public exploit
Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate s…
-
Unscored —CVE-2017-8224 Public exploit
Wireless IP Camera (P2P) WIFICAM devices have a backdoor root account that can be accessed with TELNET.
-
Unscored —
On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An…
-
Unscored —
TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via…
-
Unscored —CVE-2017-8221 Public exploit
Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communicat…
-
Unscored —
vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin a…
-
Unscored —CVE-2017-8223 Public exploit
On Wireless IP Camera (P2P) WIFICAM devices, an attacker can use the RTSP server on port 10554/tcp to watch the streami…
-
Unscored —
Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported ve…
-
Unscored —
Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported ve…
-
Unscored —
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Audience workben…
-
Unscored —
Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported ve…
-
Unscored —
Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported ve…
-
Unscored —
Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported ve…